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A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 
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Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

1 )KI Responsive to communication(s) filed on 6/2/08 . 
2a )^ This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-46 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) |EI Claim(s) 1-46 is/are rejected. 

7) 0 Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) Q The specification is objected to by the Examiner. 

10) D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
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DETAILED ACTION 

Claims 1 - 46 are pending. 

This action is in response to the communication filed on 12/13/07. 
All objections and rejections not set forth below have been withdrawn. 

Claim Rejections - 35 USC § 101 

35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

Claims 14 - 18 are rejected under 35 U.S.C. 101 because the claimed invention 
is directed to non-statutory subject matter. Specifically, these claims broadly recite 
computer elements as software per se (see par. 12, 16 of applicant's specification, 
wherein the recited means are disclosed as software [e.g. "software", "software driver", 
"application"]). Computer instructions without a tangible and statutory embodiment fail 
to fall within one of the statutory categories of invention. 

Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 
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(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 

Claims 1-46 are rejected under 35 U.S.C. 102(b) as being anticipated by 
Thompson et al. (Thompson), "Device Security Mechanism Based on Registered 
Passwords", EP 1,111,495 A1. 

Regarding claim 1, Thompson discloses: 

a processor; and a memory component that stores (fig. 2:1 00): 

a security module adapted to control access to a secure computer resource by a 

user via a client based on verification of a security credential provided by the user (fig. 

2:108; par. 11); 

and verification data disposed on the client and accessible by the security 
module (fig. 4:404, 406, 408, 412, 414, 416, 418 - herein disclosed is information 
disposed on the client which implements a recovery mechanism), the security module 
adapted to enable the user to recover the security credential from the client based on a 
response received from the user associated with the verification data (fig. 6). For the 
purpose of examination, the examiner interprets "to recover the security credential from 
the client" in a manner consistent with the applicant's specification. Specifically, the 
applicant states in paragraph 15, "For example, as used herein, "recovering" security 
credential 100 includes enabling the user to independently retrieve security credential 
100, enabling the user to independently reset security credential 100, and/or 
automatically having security credential 100 reset for the user by security module 70 
without assistance from support personnel or an external computer resource." 
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Regarding claim 2, Thompson discloses: 

wherein the security module is adapted to enable the user to reset the security 
credential based on the response (fig. 4:414). 

Regarding claim 3, Thompson discloses: 

wherein the security module is adapted to generate a query to present to the 
user based on the verification data (fig. 6:602,608,610). 

Regarding claim 4, Thompson discloses: 

wherein the security module is adapted to control booting of the client based on 
the response (Abstract). 

Regarding claim 5, Thompson discloses: 

wherein the security module is adapted to initiate a collection module to acquire 
the verification data from the user (fig. 4). 

Regarding claim 6, Thompson discloses: 

wherein the security module is adapted to encrypt the security credential based 
on the verification data (fig. 4:406). 

Regarding claim 7, Thompson discloses: 
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wherein the security module is adapted to decrypt an encrypted security 
credential based on the response (par. 22). 

Regarding claim 8, Thompson discloses: 

wherein the security module is disposed in a basic input/output system (BIOS) 
(par. 11). 

Regarding claim 9, Thompson discloses: 

wherein the security module is adapted to control access to a secure 
communications network (col. 6:40-44 - access to the operations of the client [i.e. 
network access], is controlled). 

Regarding claim 10, Thompson discloses: 

wherein the security module is adapted to control access to a computer network 
resource (col. 6:40-44 - access to the operations of the client [i.e. network resource 
access] is controlled). 

Regarding claim 11, Thompson discloses: 

wherein the security module is adapted to enable the user to retrieve the security 
credential based on the response (par. 22). 



Regarding claim 12, Thompson discloses: 
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wherein the security module is adapted to automatically reset the security 
credential based on the response (fig. 6:610,612,614,616,618). 

Regarding claim 13, Thompson discloses: 

wherein the security module is disposed on the client (fig. 2). 

Regarding claims 14-46, they are system method and means claims essentially 
corresponding to claims 1-13, and they are rejected, at least, for the same reasons. 



Response to Arguments 

Applicant's arguments filed 6/2/08 have been fully considered but they are not 
persuasive. 

Applicant argues essentially that: 

(i) With regard to claims 14 - 18, Applicants respectfully traverse this rejection for at 
least the reason that these claims include "means for" language that invokes 35 U.S.C. 
§112 116. As "means for" claims are a statutorily recognized claim, Applicants submit 
that these claims, in their current format, meet all the requirements of 35 U.S.C. §101. 
As additional proof, MPEP §2181 states (quoting In re Donaldson Co., 16 F.3d 1189, 
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1195, 29 USPQ2d 1845, 1850 (Fed. Cir. 1994)(in banc))"35 U.S.C. 112, sixth paragraph 
states that a claim limitation expressed in means-plus-function language "shall be 
construed to cover the corresponding structure" (emphasis added). Accordingly, 
Applicants submit that this rejection is improper and that claims 14- 18 meet all the 
requirements of 35 U.S.C. §101. (Remarks, pg. 10) 



In response, the examiner respectfully points out that the recitation of "means for" 
does not necessarily result in a "statutorily recognized claim". In the present case, the 
applicant has shown within the applicant's specification that the recited means of claims 
14 - 18 are implemented as software (e.g. see par. 12, 16). Because these claims 
recite software per se. they are appropriately rejected as non-statutory. 
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(ii) There is absolutely no suggestion of recovering the password. For at least the 
reason that Thompson fails to even suggest this element of claim 1, claim 1 is 
allowable. 

There is absolutely no suggestion of recovering the password. For at least the 
reason that Thompson fails to even suggest this element of claim 14, claim 14 is 
allowable. 

There is absolutely no suggestion of recovering the password. For at least the 
reason that Thompson fails to even suggest this element of claim 19, claim 19 is 
allowable. 

There is absolutely no suggestion of recovering the password. For at least the 
reason that Thompson fails to even suggest this element of claim 31, claim 31 is 
allowable. 

There is absolutely no suggestion of recovering the password. For at least the 
reason that Thompson fails to even suggest this element of claim 40, claim 40 is 
allowable. (Remarks, pg. 11 - 18) 

In response, the examiner respectfully reminds the applicant of the applicant's 
own disclosure, wherein the applicant states that "recovering the password" comprises 
"enabling the user to independently retrieve security credential 100, enabling the user to 
independently reset security credential 100, and/or automatically having security 
credential 100 reset for the user by security module 70 without assistance from support 
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personnel or an external computer resource." As the recovery mechanism of the prior 
art is consistent with this interpretation, the examiner kindly notes that the prior art 
discloses the claimed features (e.g. Thompson, fig. 4). 



Conclusion 

The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure: 

See Notice of References Cited. 

THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 .136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 
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Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to JEFFERY WILLIAMS whose telephone number is 
(571)272-7965. The examiner can normally be reached on 8:30-5:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Emmanuel Moise can be reached on (571) 272-3865. The fax phone 
number for the organization where this application or proceeding is assigned is (703) 
872-9306. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 

J. Williams 
AU: 2137 



/Nasser G Moazzami/ 

Supervisory Patent Examiner, Art Unit 2136 



